diff --git a/install.sh b/install.sh
index 87b86d6..9cb7c63 100755
--- a/install.sh
+++ b/install.sh
@@ -313,17 +313,33 @@ if [ -n "$EXISTING_ENTRY" ]; then
   fi
 fi
 
-# Determine default host and token (env vars > existing > built-in defaults)
+# Determine default host and token (env vars > existing config; no built-in token).
+# Per Infisical-only secrets policy, tokens MUST come from env vars at install time.
+# Source values from Infisical /gitea (per environment) before re-running this script.
 BUILTIN_HOST="https://gitea.dev.marcus-law.co.il"
-BUILTIN_TOKEN="90acb3ebc0f98edfb7a373ef9902bde1cc8eff96"
 
 DEFAULT_HOST="${GITEA_DEFAULT_HOST:-${CURRENT_HOST:-$BUILTIN_HOST}}"
-DEFAULT_TOKEN="${GITEA_DEFAULT_TOKEN:-${CURRENT_TOKEN:-$BUILTIN_TOKEN}}"
+DEFAULT_TOKEN="${GITEA_DEFAULT_TOKEN:-${CURRENT_TOKEN:-}}"
+
+if [[ -z "$DEFAULT_TOKEN" ]]; then
+    err "No token resolved for default server. Set GITEA_DEFAULT_TOKEN env var (Infisical /gitea dev → API_TOKEN) and re-run."
+    exit 1
+fi
 
 ok "Default server: $DEFAULT_HOST"
 
-# Built-in additional servers
-BUILTIN_SERVERS='{"prod":{"host":"https://gitea.prod.marcus-law.co.il","token":"44254bf41fb8eba17b467d46bbac792db5b57333","insecure":false},"nautilus":{"host":"https://gitea.nautilus.marcusgroup.org","token":"17c8a6ea2af0b9a1d27d6fdceaf65b2d8ebc4a66","insecure":false}}'
+# Built-in additional server hosts (no tokens — those come from env vars).
+# Set GITEA_PROD_TOKEN and GITEA_NAUTILUS_TOKEN env vars (Infisical /gitea prod|nautilus → API_TOKEN).
+BUILTIN_SERVERS_TEMPLATE='{"prod":{"host":"https://gitea.prod.marcus-law.co.il","token":"__PROD_TOKEN__","insecure":false},"nautilus":{"host":"https://gitea.nautilus.marcusgroup.org","token":"__NAUTILUS_TOKEN__","insecure":false}}'
+
+if [[ -z "${GITEA_PROD_TOKEN:-}" || -z "${GITEA_NAUTILUS_TOKEN:-}" ]]; then
+    err "GITEA_PROD_TOKEN and GITEA_NAUTILUS_TOKEN env vars are required for the additional-servers template."
+    err "Source values from Infisical /gitea prod and /gitea nautilus, then re-run."
+    exit 1
+fi
+
+BUILTIN_SERVERS="${BUILTIN_SERVERS_TEMPLATE//__PROD_TOKEN__/$GITEA_PROD_TOKEN}"
+BUILTIN_SERVERS="${BUILTIN_SERVERS//__NAUTILUS_TOKEN__/$GITEA_NAUTILUS_TOKEN}"
 
 # ── Step 6: Add additional servers ─────────────────────────────────────────